15:00:18 <noonedeadpunk> #startmeeting openstack_ansible_meeting
15:00:18 <opendevmeet> Meeting started Tue Feb 10 15:00:18 2026 UTC and is due to finish in 60 minutes.  The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:00:18 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:00:18 <opendevmeet> The meeting name has been set to 'openstack_ansible_meeting'
15:00:23 <noonedeadpunk> #topic rollcall
15:00:31 <noonedeadpunk> I'm semi around today tbh
15:00:39 <noonedeadpunk> need to sort out some personal things :(
15:05:25 <jrosser> o/ hello
15:05:55 <damiandabrowski> hi!
15:07:40 <jrosser> should we talk about www_authenticate_uri
15:08:06 <jrosser> andrewbonney: ^ did you see this
15:08:16 <jrosser> https://review.opendev.org/q/topic:%22use-public-www-authenticate-uri%22
15:08:34 <andrewbonney> yes I did - how has that not come up before?
15:10:13 <noonedeadpunk> #topic www_authenticate_uri
15:10:32 <noonedeadpunk> I kinda failed to look into the keystoneauthtoken code yesterday
15:11:18 <noonedeadpunk> But reading around it sounds like it make sense overall, if we do have a way to ensure that services themselves would not use it to talk to the keystone
15:11:35 <noonedeadpunk> I think we can be adding some simple firewall rule for AIO/CI for that?
15:12:25 <noonedeadpunk> as I bet we're missing services' defenition here and there
15:15:36 <opendevreview> Ivan Anfimov proposed openstack/openstack-ansible-plugins stable/2025.1: wip  https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/976115
15:16:32 <opendevreview> Ivan Anfimov proposed openstack/openstack-ansible-plugins stable/2025.1: Pin setuptools  https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/976115
15:17:41 <opendevreview> Ivan Anfimov proposed openstack/openstack-ansible-plugins stable/2025.1: Pin setuptools  https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/976115
15:18:07 <opendevreview> Ivan Anfimov proposed openstack/openstack-ansible-plugins stable/2025.1: Pin setuptools  https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/976115
15:18:19 <noonedeadpunk> is there anything specific we wanna to talk regarding www_authenticate_uri ?
15:18:52 <noonedeadpunk> during this/next week I'm having really limited availability, so in fact won't be able to pull up some testing for it
15:22:25 <noonedeadpunk> Like most important thing to check wrt the topic, is that this doesn't make services to talk over public endpoints
15:29:29 <noonedeadpunk> #topic gate health
15:29:37 <noonedeadpunk> I think our gates are just broken now
15:29:59 <noonedeadpunk> I did not check much detauls, and if that is related to setuptools, like for all other projects
15:30:19 <noonedeadpunk> But it seems to fail on horizon deployment
15:30:49 <noonedeadpunk> which is like... some git issue?
15:31:14 <noonedeadpunk> #link https://zuul.opendev.org/t/openstack/build/9f446f5c7a2a459280ea4b6e138c7246/log/job-output.txt#13623
15:34:36 <noonedeadpunk> this needs kinda some investigation, as it seems to be consistent right now
15:34:42 <noonedeadpunk> #topic office hours
15:37:15 <noonedeadpunk> it would be nice to have another vote on https://review.opendev.org/c/openstack/openstack-ansible/+/976116
15:37:36 <noonedeadpunk> as I did not actually released previous buymnp, as this includes quite nice fixes as well
15:38:04 <noonedeadpunk> I wonder if I should make it as X.1.0
15:44:01 <jrosser> sorry got distracted
15:44:28 <jrosser> yes i was also thinking that we should forcibly blackhole the public endpoint IP from the mgmt network
15:49:47 <noonedeadpunk> ++ ok, that makes sense then
15:55:58 <jrosser> iirc we already have iptables stuff doing nat there so there should be an obvious place to add it
16:00:54 <noonedeadpunk> #endmeeting